𝙇𝙖𝙧𝙧𝙮 𝘾𝙤𝙫𝙚𝙧𝙩

Regarding potential attacks on energy, food, and water infrastructure, the threat is quite real. Someone is currently probing infra and feeling it out, it is an active threat. Even a little preparation can be helpful, just in case. This comes from the joint cybersecurity advisory released by the NSA and partner agencies on August 19: 'The threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using Al-generated exploitation scripts disguised as legitimate monitoring tools. The actors leverage Internet scanning services to find Internet-exposed PLCs running outdated software or that are otherwise poorly protected. The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. This is not a theoretical risk - it is an active threat. Depending on the specific circumstances, exploitation of poorly protected PLCS could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems.' 'Using Al to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools. In addition, Al enables adversaries to rapidly leverage additional attack vectors and adapt to defensive measures. Threat actors can easily collect public information about vulnerabilities and weaknesses, find exposed and exploitable PLCs, and use Al-generated scripts to act on that information. If PLCs are exposed to the Internet, they are at high risk for exploitation. Threat actors are leveraging open source industrial automation libraries - specifically snap7.d11/python-snap7 - combined with Al-assisted scripting to create custom tools that mimic legitimate OT monitoring solutions. These tools provide read/write access to Siemens S7 Series PLC memory, configuration data, and ladder logic programs via the S7comm protocol.'